@7365admin1/core 3.52.15 → 3.52.16

package/dist/index.mjs

@@ -13522,6 +13522,22 @@ async function hasOrgOwnership(userId, orgId) {
   );
   return Boolean(found);
 }
+async function holdsRole(userId, roleId) {
+  const id = userId?.toString() ?? "";
+  const role = roleId?.toString() ?? "";
+  if (!id || !role || !ObjectId25.isValid(id) || !ObjectId25.isValid(role)) {
+    return false;
+  }
+  const db2 = useAtlas16.getDb();
+  if (!db2)
+    return false;
+  const member = await db2.collection("members").findOne({
+    user: new ObjectId25(id),
+    role: new ObjectId25(role),
+    status: { $ne: "deleted" }
+  });
+  return Boolean(member);
+}
 
 // src/services/service-provider-invite.service.ts
 import {
@@ -18489,6 +18505,11 @@ async function requireRoleOrg(req, org) {
   }
   await requireOrgAccess(req, orgId);
 }
+async function requireRoleRead(req, roleId, org) {
+  if (await holdsRole(callerId(req), roleId))
+    return;
+  await requireRoleOrg(req, org);
+}
 function useRoleController() {
   const {
     addRole: _createRole,
@@ -18598,6 +18619,7 @@ function useRoleController() {
     }
     try {
       const data = await _getRoleById(_id);
+      await requireRoleRead(req, _id, data?.org);
       res.json(data);
       return;
     } catch (error2) {
@@ -92087,6 +92109,7 @@ export {
   hasOrgInvitation,
   hasOrgOwnership,
   hidRawUint64,
+  holdsRole,
   incidentReportLog,
   incidents_namespace_collection,
   isCameraEntitled,